JFIF$        dd7 

Viewing File: /usr/share/cagefs/__pycache__/feature_manager.cpython-311.opt-1.pyc

�

����֢�	���ddlZddlZddlZddlZddlmZddlmZddlm	Z	ddl
Z
ddlmZdZ
e
jdd��ZGd	�d
ej��ZeGd�d����ZeGd
�d����ZGd�d��Zdefd�Zeddeedej������gZdeefd�Zd�Zd�Zedkreje����dSdS)�N)�	dataclass)�Path)�Callable)�DEFAULT_FLAGS_STORAGE_PATHz/etc/cagefs/enabled_features�feature_managerz/var/log/cloudlinux/cagefs.logc�N�eZdZdZej��Zej��ZdS)�FlagBehaviorz�
    Defines the behavior of a CloudLinux Server Flag
    based on the presence of a file. The existence of this flag
    not only indicates that the 'feature' is enabled
    but could also mean it is explicitly disabled by creating the file.
    N)�__name__�
__module__�__qualname__�__doc__�enum�auto�ENABLE_ON_PRESENT�DISABLE_ON_PRESENT���c/builddir/build/BUILDROOT/cagefs-7.6.28-1.el9.cloudlinux.x86_64/usr/share/cagefs/feature_manager.pyr	r	s8��������"��	����"�������rr	c�D�eZdZUdZeed<eed<edefd���Z	dS)�Flagz�
    Represents a CloudLinux Server Flag
    typically located at /opt/cloudlinux/flags/enabled-flags.d/
    with a specific behavior based on a file existence.
    �	flag_name�
flag_behavior�returnc���tt|j�d���}|���}|jt
jkr|S|jt
jkr|Std���)Nz.flagz/Invalid value for the "flag_behavior" attribute)	rrr�existsrr	rr�RuntimeError)�self�	flag_path�flag_existss   r�enabledzFlag.enabled.sm���3���5M�5M�5M�N�N�	��&�&�(�(�����!?�?�?���
�
�<�#B�
B�
B�"�?�"��P�Q�Q�QrN)
r
rrr
�str�__annotations__r	�property�boolr rrrrr$sc���������
�N�N�N�����
�	R��	R�	R�	R��X�	R�	R�	Rrrc�t�eZdZUdZeed<eed<eed<eed<ede	fd���Z
edefd���Zd	S)
�
CageFsFeaturez=
    Represents a feature within the CageFS file system.
    �name�description�handler�flagrc�6�tt|j��S)zE
        Returns the path to the CageFS feature marker file.
        )r�ENABLED_FEATURES_DIRr'�rs r�feature_marker_pathz!CageFsFeature.feature_marker_pathEs��
�(�$�)�4�4�4rc�L�|j���o|jjS)z�
        Determines if the CageFS feature is enabled based on the existence
        of its feature marker file and CloudLinux Server Flag status.
        )r.rr*r r-s rr zCageFsFeature.enabledLs#���'�.�.�0�0�F�T�Y�5F�FrN)
r
rrr
r!r"rrr#rr.r$r rrrr&r&;s�����������I�I�I�����
����
�J�J�J�
�5�T�5�5�5��X�5��G��G�G�G��X�G�G�Grr&c�N�eZdZdZdeefd�Zd�Zd�Zdefd�Z	defd�Z
d	S)
�CageFsFeatureManagerz2
    Manages a collection of CageFS features.
    �featuresc��||_dS�N)r2)rr2s  r�__init__zCageFsFeatureManager.__init__Zs
��-5��
�
�
rc�D�|jD]}|�|���dSr4)r2�_enable_feature�r�features  r�enablezCageFsFeatureManager.enable]s4���}�	*�	*�G�� � ��)�)�)�)�	*�	*rc�D�|jD]}|�|���dSr4)r2�
_sync_featurer8s  r�synczCageFsFeatureManager.syncas4���}�	(�	(�G����w�'�'�'�'�	(�	(rr9c�8�|j���dSr4)r.�touchr8s  rr7z$CageFsFeatureManager._enable_featurees���#�)�)�+�+�+�+�+rc�:�|�|j��dSr4)r)r r8s  rr<z"CageFsFeatureManager._sync_featurehs�������(�(�(�(�(rN)r
rrr
�listr&r5r:r=r7r<rrrr1r1Us���������6��m�!4�6�6�6�6�*�*�*�(�(�(�,�}�,�,�,�,�)�]�)�)�)�)�)�)rr1�
is_enabledc�
�d}td|��}td|��}|rH|���s0|j���rtj||��dSdSdS|�d���dS)z�
    Handles the hardening of D-Bus configuration based on the enabled state.
    Essentially, just copies/removes the config file to/from the appropriate place.
    zcagefs-dbus-hardening.confz/usr/share/cagefs/configs/dbusz/etc/dbus-1/system.dT)�
missing_okN)rr�parent�shutil�copy2�unlink)rB�config_name�
local_path�installed_paths    r�handle_dbus_hardeningrLls���
/�K��6��D�D�J��0�+�>�>�N��/��$�$�&�&�	5�>�+@�+G�+G�+I�+I�	5��L��^�4�4�4�4�4�	5�	5�	5�	5�	�����.�.�.�.�.rzdbus-hardeningzVRestrict user's capability to communicate with systemd via D-Bus using certain methodszdisable-dbus-hardening)rr)r'r(r)r*r2c�L�t|��}|���dS)z+
    Enable specified CageFS features.
    N)r1r:)r2�managers  rr:r:�s'��#�8�,�,�G��N�N�����rc�V�tt��}|���dS)zX
    Synchronize the state of CageFS featues based on their current enabled status.
    N)r1�FEATURESr=)rNs rr=r=�s"��#�8�,�,�G��L�L�N�N�N�N�Nrc���tjd���}|�dd���}|�dd���}tD]'}|�d	|j��d
|j����(|�dd
���|����	�j	xdkr<�fd�tD��}|s|�
d��t|��dSdkrt��dS	|�
��dS#t$r'}t�
d|���Yd}~dSd}~wwxYw)Nz,Available manipulations with CageFS features)r(�commandzAvailable commands)�dest�helpr:zEnable CageFS features)rTz--�
store_true)�actionrTr=z<Sync CageFS features based on the state of the feature flagsc	�f��g|]-}t�|j�dd�����+|��.S)�-�_)�getattrr'�replace)�.0r9�argss  �r�
<listcomp>zmain.<locals>.<listcomp>�sP���N�N�N��&�t�W�\�-A�-A�#�s�-K�-K�L�L�N�G�N�N�Nrz9At least one feature is required for the "enable" command�z<An error occurred during manipulations with CageFS features:)�exc_info)�argparse�ArgumentParser�add_subparsers�
add_parserrP�add_argumentr'r(�
parse_argsrR�errorr:r=�
print_help�	Exception�logger)�parser�
subparsers�
parser_enabler9r2�er]s      @r�mainro�s����
�
$�B�D�D�D�F��&�&�I�<P�&�Q�Q�J��)�)�(�9Q�)�R�R�M��
�
���"�"��������$�	#�	
�	
�	
�	
�����S��U�U�U������D���l������N�N�N�N�8�N�N�N���^��L�L�!\�]�]�]��x� � � � � ������������!�!�#�#�#��q���������S��	�	!�	!�	!��q�q�q�q�q��������s%� AD�(D�=D�
E�E�E�__main__)rarrF�sys�dataclassesr�pathlibr�typingr�logs�clflags.configrr,�setup_loggerrj�Enumr	rr&r1r$rLrrPrAr:r=ror
�exitrrr�<module>rzs;����������
�
�
�
�
�
�
�
�!�!�!�!�!�!�����������������5�5�5�5�5�5�5��	��	�,�;�
=�
=��%�%�%�%�%�4�9�%�%�%��R�R�R�R�R�R�R���R�,�G�G�G�G�G�G�G���G�2)�)�)�)�)�)�)�)�.
/�d�
/�
/�
/�
/�$�M�
�C�%�
�T�.�&�9�
�
�
�	�	�	����T�-�(��������%�%�%�P�z����C�H�T�T�V�V�������r
Back to Directory  nL+D550H?Mx ,D"v]qv;6*Zqn)ZP0!1 A "#a$2Qr D8 a Ri[f\mIykIw0cuFcRı?lO7к_f˓[C$殷WF<_W ԣsKcëIzyQy/_LKℂ;C",pFA:/]=H  ~,ls/9ć:[=/#f;)x{ٛEQ )~ =𘙲r*2~ a _V=' kumFD}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo(3=M(zȰ+i*NAr6KnSl)!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\͔]ޒS߼Jȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtfh9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N+0e2]]9VTPO׮7h(F*癈'=QVZDF,d߬~TX G[`le69CR(!S2!P <0x<!1AQ "Raq02Br#SCTb ?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ τV׸YTD I62'8Y27'\TP.6d&˦@Vqi|8-OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL u"TÙM=6(^"7r}=6YݾlCuhquympǦ GjhsǜNlɻ}o7#S6aw4!OSrD57%|?x>L |/nD6?/8w#[)L7+6〼T ATg!%5MmZ/c-{1_Je"|^$'O&ޱմTrb$w)R$& N1EtdU3Uȉ1pM"N*(DNyd96.(jQ)X 5cQɎMyW?Q*!R>6=7)Xj5`J]e8%t!+'!1Q5 !1 AQaqё#2"0BRb?Gt^## .llQT $v,,m㵜5ubV =sY+@d{N! dnO<.-B;_wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc.WDtA$j@:) -# u c1<@ۗ9F)KJ-hpP]_x[qBlbpʖw q"LFGdƶ*s+ډ_Zc"?%t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi`]uJVoVDG< SB6ϏQ@ TiUlyOU0kfV~~}SZ@*WUUi##; s/[=!7}"WN]'(L! ~y5g9T̅JkbM' +s:S +B)v@Mj e Cf jE 0Y\QnzG1д~Wo{T9?`Rmyhsy3!HAD]mc1~2LSu7xT;j$`}4->L#vzŏILS ֭T{rjGKC;bpU=-`BsK.SFw4Mq]ZdHS0)tLg